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Q , Abstract 

We show that an oracle A triat contains either 1/4 or 3/4 of all strings of length n can be 
t~^. ' used to separate EQP from the counting classes MOD p kP, where p is a prime. Our proof makes 

■ use of the degree of a representing polynomial over Z p k . We show a linear lower bound on the 

degree of this polynomial. We also show an upper bound of 0(n 1 ^ log p m ) on the degree over the 
ring Z m , whenever m is a squarefree composite with largest prime factor p. 
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1 Introduction 
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One of the central goals of complexity theory is to understand the various relationships between 
■ complexity classes. In particular, with the introduction of quantum complexity theory, an exciting 

new challenge has arisen in understanding the relationship between classical and quantum classes. 
Q_i! In particular, one asks about the strength of BQP, the class of all problems that can be emciently 

solved using a quantum computer with bounded error, and EQP, the class of problems that can 
be emciently solved using a quantum computer which always gives the right answer, compared 
to classical complexity classes. Unfortunately, qüestions in this direction are notoriously hard to 
settle. 

A more feasible task however, is to show that relative to some oracle, a certain relationship 
between two complexity classes holds. Early results include a relativized separation of BQP from 
BPP by Bernstein and Vazirani [BV97], and a relativized separation of EQP from NP UcoNP by 
Berthiaume and Brassard [BB94]. Green and Pruim [GP01] improved upon the latter result by 
exhibiting an oracle relative to which EQP ^ P NP . 

In this paper we ask whether EQP can be separated from MOD m P by an oracle. Note that 
due the linear lower bound on the degree of a polynomial representing the parity function over the 
reals (Beals et al. [BBC + 98]), the other direction, separating MOD m P from EQP, is easy Recali 
that MOD m P is the class of languages decided by non-deterministic polynomial time machines that 
accept iff the number of accepting computation paths is nonzero modulo m. In particular, we ask 
whether an oracle that is promised to hold either 1/4 or 3/4 of all the strings of each length can 
be used to separate EQP from MOD m P. This leads us to investigate the degree of a polynomial 
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q : Z 1 ^ — > Z m that for x G {0, l} n has 7^ if \x\ = n/4, and g(x) = if \x\ = 3n/4, where \x\ 
denotes the number of l's in a binary string. When m is a prime power, we show a linear lower 
bound on the degree of any such polynomial. This implies that for prime p, EQP can be separated 
from MOD p kP (and specifically ©P). We then focus our attention on composite m. If m is a 
squarefree composite, we show an upper bound on the degree of ©(n 1 / 10 ^" 1 ), where p is the largest 
prime factor of m. As is the case with the OR function (Barrington, Beigel, and Rudich [BBR92]), 
this gives another example of a Boolean function whose representing degree drops significantly if 
we go from prime power moduli to composite moduli. 

2 Preliminaries 

2.1 Complexity Theory 

We assume familiarity with the bàsics of classical and quantum complexity theory. For the former 
[Pap94] provides an excel·lent introduction, for the latter we recommend [NC00]. In particular we 
are interested in the complexity classes MOD m P and EQP, definitions of which are provided here 
for completeness' sake. Let M be a non-deterministic Turing machine. By #M(x) we denote the 
number of accepting computations of M on input x. 

Definition 1 Let L Ç {0, 1}*. We say that L G MOD m P iff there exists a polynomial time non- 
deterministic Turing machine M , such that 

1. x £ L #M(x) mod m^O 

2. x £ L #M(x) mod m = 

Definition 2 Let L Ç {0, 1}*. We say that L € EQP iff there exists a polynomial time quantum 
Turing machine M , such that 

1. i£L4> Pr[M accepts x] = 1 

2. x £ L Pr[M accepts x] = 

We define relativized versions of these complexity classes in the usual way. 

2.2 Combinatòries 

For natural numbers n and k, we denote by (n)& the /c-ary representation of n, i.e. the string 
. . .020100, with < Oj < k, such that n = Y^i a ik l - Note that the first (from the right) nonzero 
digit of [n)k is given by the least i such that k 1 \ n, an observation to which we shall frequently 
refer. 

In 1878 Lucas [Luc78] gave a method to easily determine the value of (^) mod p, for prime p, 
and the following theorem is now known as Lucas' Theorem. It is one of the main ingredients in 
the proofs of our results. By x[i] we denote the symbol at the íth position of string x. 

Theorem 1 (Lucas) Let p be a prime number, and n, k positive integers, then 

(ï) modí,= n((^w) modp ' 

where m is the maximal index i such that (n) p [í] ^ or (k) p [i] 7^ 0, and we use the convention that 
ix) = ® whenever x > 0. 
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Another theorem that we shall make use of in this paper is the Chinese Remainder Theorem. We 
state it here for completeness' sake. 

Theorem 2 (Chinese Remainder Theorem) Let ri,...,re be pairwise relatively prime, and 



where the isomorphísm is gíven by ip(x mod m) t— > (x mod n, . . . , x mod rg). 
2.3 Representation of Boolean Functions over Z m 

We now define what it means for a polynomial over Z m to represent a Boolean function. We should 
note that there are different opinions on what would be the most natural definition of representing a 
Boolean function by a polynomial over Z m , see for instance the discussion in Tardos and Barrington 
[TB95]. The definition we use here, is what is sometimes called one-sided representation. 

Definition 3 Let g : {0, 1}™ — > {0, 1} be a Boolean function, and p : Z^ — > Z m a polynomial. 
We say that p represents g over Z m iff for all x G {0, 1}™, p{x) = 44> g{x) = 0. By the degree 
deg(p) of a polynomial p : Z^ — > Z m , we mean the size of its largest monomial. The degree of 
a Boolean function g : {0,1}™ — > {0,1} over Z m is then defined as deg(g,m) = min{deg(p) | 
p represents g overZ m }. 

Note that since for all x G {0, 1} and £ > 0, we have that x e = x, we can restrict ourselves to 
multilinear polynomials. 

When the modulus is a prime, we have the following two interesting lemmas. Both are usually 
stated as being folklore results. See [Bei93] for an overview of these and other similar results. 

Lemma 3 Let p be a prime, and g : Z™ — > Z p be a polynomial of degree d, then there is a polynomial 



h : Z™ — > Z p of degree (p—l)d, such that for all x £ {0, 1}™, h(x) E {0, 1} ; and h(x) = iff g(x) = 0. 



We should note that Theorem 19, item (ii) in [Bei93] contains an erroneous proof. We have learned 
about a correct result via Richard Beigel (personal communication, October 2002). It is stated in 
the next lemma. 



m = ní=i r i- Then 



Proof Take h = g p 1 . By Fermat's little theorem, h(x) = 1 vnoàp iff g(x) / 0. 



□ 



Lemma 4 Let k be a positive ínteger, and p a prime. If g : Z" fc — > Z p fe is a polynomial of degree 
d, then there exists a degree d(2p k ^ 1 — 1) polynomial h : Z™ — > Z p; such that for all x G {0, l} n , 



h{x) = iffg(x) = 0. 



Proof By Theorem 1, we have that for every prime p, and positive integer m 




(1) 



Define the iih elementary symmetric function of the n variables yi, . . . , y n , i < n, as 





l<4<-<fi<nj=l 
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Note that if each yi € {0, 1}, and exactly \y\ of them are 1, then the value of the above expression 
is ('^')- Now write g as a sum of monomials of coefncient 1, i.e., replace for example 3x\X2 by 
x\X2 + x\X2 + x\X2- Let (y ^) be the i-th elementary symmetric function of the monomials in g. 
Define h(x) as 

The degree of h{x) is d(2p k ~ 1 — 1). If g(a;) = mod then by Equation 1, ( ff ; ) = mod p for 

all < i < k, hence h(x) = mod p. On the other hand, if g(x) ^ mod p k , then using Equation 
1, let r be the least value such that ( 9 ^) ^ modp. Note that the rth term in h{x) is nonzero 
modulo p, but all the others are zero modulo p, since all terms after the rth contain the factor 

(i " = °> and hence h (x) # mod p. □ 

3 Linear Lower Bound for Prime Power Moduli 

In this section we restrict ourselves to the field Z p k, where p is a prime. For a binary string x, let \x\ 
denote its Hamming weight (number of l's). We consider any Boolean function g : {0, l} n — > {0, 1}, 
that has g{x) = 1 if |x| = n/4 and g(x) = if \x\ = 3n/4, and prové that it has deg(g,p k ) = 

The rough idea behind our proof is the following. Using Lemmas 3 and 4 we restrict ourselves 
to polynomials over Z p that are always 0/1 valued on inputs from the domain {0, l} n . This only 
increases the degree by a multiplicative constant. Now assume there exists a low degree polynomial 
q that represents g. We then use the property that for all x € {0, l} n , q(x) ^ if \x\ = n/4 and 
q{x) = if |x| = 3n/4 to set up a system of linear equations over the coefficients of the monomials 
in q. Using Theorem 1 we then show that this system is unsolvable, and conclude that no such low 
degree polynomial q exists. 

Theorem 5 Let p be a prime, n = 4p r , and g : {0, l} n — > {0, 1} be such that g(x) = 1 if \x\ = n/A, 
and g(x) = if \x\ = 3n/4. Then 

deg(g,p k ) > 



A(2p k ~ 1 - l)(p- 1)' 



Proof We will prové the lemma for primes p > 3. The case where p G {2, 3} has an identical proof, 
and we leave this to the reader. 

Consider any degree d < ^2p k - 1 -i)(p-i) mur t mn ear polynomial p over Z p k that represents g. 
Using Lemmas 3 and 4, transform p into a polynomial q that represents g over Z p , and that has 
q(x) G {0, 1} for all x <G {0, l} n . This will only increase the degree of q by a multiplicative factor 
(p — l)(2p k ~ 1 — 1). We now prové a lower bound of n/4 on the degree of q. Write q as 

q(xi,...,x n ) = ^ cs-mon(5), 

SÇ[n],\S\<n/4 

where mon(S) = Hígs 2 ^' 1^1 denotes the size of S, and each cs € Z p . On input x € {0, l} n , with 
x\ = ... = X3 n /4 = 1 and x 3n / 4+1 = . . . = x n = 0, we have that 

y~] cs = mod p. (2) 

5Ç[3n/4],|5|<n/4 
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However, every input x G {0, l} n with exactly n/4 out of the first 3n/4 variables set to 1 gives a 
constraint 

^2 C S = 1 mod p, 

SÇT 

where T Ç [3n/4], is the set of n/4 indices of variables that are set to 1 in the input x. Note that 
the total number of such constraints modulo p is 

f3n/4\ /3p< 



U/4J 



mod p = mod p = 3, 



by Theorem 1. Also, note that every monomial mon(S) with S Ç [3n/4], of degree < t < n/4 = p r 
occurs in exactly 

^ mod p = \ ^ J modp = 1, 



U/4 



i ) 1 \P r -i . 

constraints modulo p, which follows again from Theorem 1. To see this, note that the first r digits 
in the p-ary representation of 3p r — t and p r — t for < i < p r are all equal, but the (r + l)st digit 
of (p r - £) p is 0, and that of (3p r - i) p is 2. 
Hence summing all these constraints gives 

2c0 + ^2 cs = 3 mod p, 

SÇ[3n/4],\S\<n/4 

where the term 2c@ is due to the fact that the free term C0 of q occurs in 3 constraints modulo p. 
Since C0 G {0, 1} (because q(0 n ) G {0, 1}), we thus have a contradiction with Equation 2. Hence q 
must have degree > n/4. □ 

As a consequence of Theorem 5 we have a relativized separation of EQP from MOD p kP. 

Corollary 6 There exists an oracle A, such that 

EQP A £ MOD pk P A 

Proof For fixed r, define r* = [log 2 4p r ], and for each A Ç {0, 1}*, define A r * to be the restriction 
of A to the lexicographically first 4p r strings of length r*. Consider oracles A with the property 
that \A r *\ G {p r ,3p r } for all r. For such A, define 

L A = {0 r | \A r *\=p r }. 

Grover's algorithm [Gro96] has the property that if either a 1/4 or a 3/4 fraction of the total 
search space is a solution, then we can find out which of the two is the case with certainty using 
just one query. This observation was first made by Boyer et al. [BBHT98], and later generalized 
by Brassard et al. [BHMT00]. Using this observation, it is not hard to see that for all appropriate 
A, L A G EQP A 

We now show the existence of an A such that La MOD p kP A . The construction of A will be 
in stages. Let M\,M2, ... be an enumeration of MOD p kP oracle machines. In stage i, run Mj on 
input r % where is chosen large enough as not to interfere with any previous stages. Note that 
we may assume that Mj only makes queries to the lexicographically first 4p Ti strings of length r*. 
Call these strings j/i , 2/2 , - - - , Vip r i ■ Take an arbitrary computation path of Mj on input r % and let 
yi x , yi 2 , . . . , yi e be the queries made along this path. Note that i is upper bounded by a polynomial 
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in r{. Now for each possible appropriate setting of A on length r* , see if this path accepts. If it 
does, create a monomial which is the product of all the variables yi (if G A) or (1 — yi) (if yi ^ A), 
for 1 < i < i. Repeat this procedure for all other computation paths. The sum of all monomials 
thus obtained is a polynomial q : 1 — > Z p fc, that for x <G {0, l} 4 P r * has g(x) / if |x| = p r \ 
and g(a;) = if \x\ = 3p Ti . Furthermore, the degree of q is bounded by a polynomial in rj. But 
Theorem 5 states that such a polynomial does not exist. Hence there must exist a setting of A on 
length r* such that Mj is incorrect on input Vi . Set A in this way on length r*, this ensures that 
Mi can not decide La- Continue with stage i + 1. □ 

In the other direction, an oracle separation of MOD kP from EQP is easy to achieve. For instance, 
to separate MOD2P (= ©P) from EQP, we can use the following construction. Let B Ç {0,1}*, 
and define 

Lb = {0 r | the parity of the number of strings in B of length r is odd}. 

Clearly, L B G MOD 2 P B . However, using the fact that the degree over the reals of the representing 
polynomial for the parity function on n variables is n (Beals et al. [BBC + 98]), we can show that 
there exists a B such that Lb £ EQP B . 



4 Sublinear Upper Bound for Squarefree Composite Moduli 

We now focus our attention on representing g over the ring TL m of integers modulo m, where m is 
a squarefree composite. We prové the following theorem. 

Theorem 7 Let m be a squarefree composite with largest prime factor p, 4 | n, and g : {0, l} n — > 
{0,1} be such that g{x) = 1 if \x\ = n/A, and g(x) = if \x\ = 3n/4. Then deg(g,m) = 
0(n 1 / loe p m ). 

We will prové this result using two separate lemmas. Note that g is only well-defined on lengths 
n such that 4 | n. We split these possible lengths in 2 different categories, namely those such that 
n/4 ^ mod m, and those such that n/4 = mod m. For each of these two lengths, we separately 
prové an upper bound. A key insight that we shall need is provided by the following lemma. 

Lemma 8 If m = P1P2 ■ • • p r , then for all 1 <i <r, 

am b \ ( 3am b \ 

mod ç I mod m 



PI J V PI 

if and only if the {i + l)st digit of the Pi-ary representations of am b and 3am b differ. 

Proof Let 1 < j < r with j 7^ i. We have that pj \ pf, but pj | a ■ m b . Hence the first digit of 
(am b ) Pj is and the first digit of (pf) Pj is nonzero. By Theorem 1, it follows that 

am b \ 

f mod pj = 0, 

Pi ) 

for 1 < j < r, and j / i. Note that again by Theorem 1, the value of ( a "^ ) mod pi is determined 
by the (£+ l)st digit of (am b ) Pi , since the only nonzero digit of (Pi) Pi is the (£ + l)st and has value 
1. Likewise, the value of ( 3 pT ) is determined by the {£ + l)st digit of (3am b ) Pi . Now apply the 
Chinese Remainder Theorem. □ 
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The use of Lemma 8 stems from the following fact. Assume we have a polynomial p : Z^ — > Z m , 
where all the monomials of degree d have coeficient 1, and all other monomials have coeficient 0. 
Then for x € {0, l} n , p(x) has the value ('^') mod m. Specifically, if (™^ 4 ) mod m / ( 3n J 4 ) mod m, 
then p(x) — ( 3n J 4 ) is a representing polynomial for g of degree d. 

We shall first prové that if n/4 = am b for some b > 0, and < a < m, then there exists a 
degree at most p b+1 = 0(n l l Xog p m ) representing polynomial for g over Z m , where p is the least 
prime factor of m not occurring in a. 

Lemma 9 Let m = p\P2 • • -p r be a squarefree composíte with pi < Pi+i, < a < m, b > 0, and p 
the least prime factor of m not occurring in a. Then the following hold. 

1. ifp> 2, then ( a ™ 6 ) mod m + ( 3a p f) mod m 

2. ifp = 2, then mod m / mod m 

Proof To prové item 1, we will show that for all b, the (b + l)st digit of (am b ) p and (3am b ) p are 
different. The result then follows by Lemma 8. We distinguish between the case where p = 3, and 
p > 3. 

If p = 3, then since for all i < b, 3* | am b , but 3 6+1 \ am b , the (6 + l)st digit of (am^ is the 
first nonzero digit. However, since 3* | 3am b for i < b + 1, the (b + l)st digit of (30771^)3 is 0. 

If p > 3, then for all < i < b, we have that p l \ am b , and p % \ 3am b , but p b+1 \ am b and 
p b+1 \ 3am b . Hence, we have that the (b + l)st digit of both (am b ) p and (3am b ) p is the first nonzero 
digit. We now claim that (am b mod p b+1 )/p b / (3am b mod p b+1 )/p b , i.e., (am b ) p and (3am b ) p 
differ in their (b + l)st digit. To prové this, note that am b = c ■ p b+1 +r ■ p b , for some integer c and 
< r < p. Hence, 3am b = d ■ p b+1 + 3r ■ p b . But 3r mod p / r, for all < r < p, if p > 3 and p is 
a prime. 

To prové item 2, we show that the (b + 2)nd digit of (ara^ and (3am b )2 differ, for all b. Note 
that for both (am^ and (3am b )2, the first nonzero bit is the (6 + l)st, so both (am^ and (3am b )2 
are of the form . . . 10 b . Now if (om^ has a as its (ò + 2)nd bit, i.e. (om^ is of the form . . . 010 b , 
then (3am b )2 is of the form . . . 110 b . On the other hand, if (ara^ has a 1 as its (ò + 2)nd bit, 
i.e. (am b )2 is of the form . . . 110 6 , then (3am b )2 is of the form . . . 010 6 . Hence the (b + 2)nd bit of 
(am b )2 and (3am b )2 are different. □ 

If n is such that n/4 ^ mod m, then we can prové that constant degree suffices. 

Lemma 10 Let m = P1P2 • • • p r be a squarefree composite with pi < pi + \ . Then the following hold. 

1. ifc^ m/2, then ( am + c ) mod m + ( 3am + 3c ) mod m, for < c < m 

2. if c = m/2, then ( am + m / 2 ^ mo d m 7^ ^am+3m/2^ moc j m 

Proof We first prové item 1. If c 7^ m/2, then c ^ 3c mod m. Hence, (am + c) mod m 7^ 
{3am + 3c) mod m. 

We now prové item 2. Since m is an even squarefree number, m/2 is odd. Hence the first bit of 
(am + m/2)2 is 1. We thus have that (am + m/2)2 has the form ... 11 or ... 01. In the first case, 
(3am + 3m/2)2 then has the form . . . 01, in the second case, (3am + 3m/2)2 has the form ... 11. 
In other words, (am + 777/2)2 and (3a?77 + 3777/2)2 differ in their 2nd bit. Using Theorem 1 and the 
Chinese Remainder Theorem, the result follows. □ 
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Together, Lemmas 9 and 10 imply Theorem 7: 

Proof (of Theorem 7) Let m be a squarefree composite with largest prime factor p, 4 | n, and 
g : {0, l} n — > {0, 1} be such that = 1 if |x| = n/4, and <7(x) = if |x| = 3n/4. We will exhibit a 
representing polynomial of degree 0(n 1 ^ log p m ) for g on each length n. We distinguish two different 
cases for n: 

1. n/4 = mod m, i.e., n/4 = am b with < a < m, and 6 > 0. In this case, Lemma 9 telis us 
that if p is the least prime factor of m not in a, then either ) mod m 7= ( 3 ^™ ) mod m (if 
p > 2), or mod m 7^ (p"+\) mod m (if p = 2). In the former case, the polynomial 



( 3 7> E — <*>. 



5Ç[n],|S|=p b 

where mon(S') = r[ies x j) represents g. This polynomial has degree p h . In the latter case 



G"+0~ £ mon(s) 



SÇ[n],\S\=pW 

is a representing polynomial of degree p b+1 . 

2. n/4 ^ mod m, i.e., n/4 = am+c. In this case Lemma 10 telis us that either am+c mod m 7^ 
3am + 3c mod m (if c 7^ m/2), or ( am 2 + c ) mod m 7^ ( 3am 2 + 3c ) mod m (if c = m/2). In the 
former case, the polynomial 

n 

3am + 3c — Xi 
i=l 

is a representing polynomial for g of degree 1. In the latter case, 

/ 3am + 3c\ v-^ , 
I ) ~ mon ( 5 ) 

V 7 SÇ[n],|S|=2 

is a degree 2 representing polynomial for g. 

□ 



5 Discussion and Open Problems 

We studied the degree of a polynomial q : ZJ^ — ► Z m , that for all x £ {0, l} n has g(x) 7= if 
\x\ = n/4, and ç(x) = if |x| = 3n/4. We have proven a linear lower bound when m is a prime 
power, and an upper bound of 0(n 1/log p m ), if m is a squarefree composite with largest prime factor 
p. The former result implies a relativized separation of EQP from MOD p kP. 

A number of open qüestions are left by this research. First of all, can we prové that the upper 
bound of C^n 1 / 106 ! 3 m ) is tight? And second, what can we say about general composite m, instead 
of squarefree composite m? Establishing a good lower bound in the latter case would show a 
relativized separation of EQP from MOD m P for all m. 

Another interesting direction is to investigate whether one can exhibit an oracle relative to 
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which EQP is not contained in or higher levels of PH. This will require, however, a different and 
presumably more complex oracle construction than the one we have used here, since the language 
that separates EQP A from P NpA and MODpkP^ is in BPP A , and hence in Y. P 2 A . 
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